Slipping past a single non-recursive ../ strip with a nested ....// sequence to read a file outside the served directory
Three Next.js edge-vs-node desyncs chained: the nxtP query prefix, duplicate-cookie precedence, and a middleware matcher blind to assetPrefix
Escaping a Lua 5.5 bytecode sandbox by writing registers past the end of the stack, hijacking a table array pointer, and swapping global_State.frealloc for system
